Overview

overview

10

Static

static

10

lyjdfjthawd.exe

windows7-x64

10

lyjdfjthawd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    lyjdfjthawd.exe

  • Size

    275KB

  • Sample

    241130-1erm8szqdj

  • MD5

    81a8c700d5bdd648c2848050da4edc4b

  • SHA1

    61e9ee541aac8aea077daedd1f31497b0bec2ab4

  • SHA256

    d7e8ecfbb9b6b70ac2314516226c94a32ccaba6c31aa4da4a52fa07c2cf22cd4

  • SHA512

    473b51e3bf9bb2c787db00b574d28306f209e9f6828b8e36b67b0fea81ec5fe303a4298accff51ee058ea7542049aa33950e9951fa33f248ab3799b826050087

  • SSDEEP

    6144:Ch0ZpFC4sffny7TuLBdZlT4DIJYdy3I8ioyrN:Ch0ZpFCfB3TGyYy3ziBZ

Score
10/10
stealcvidar0174ec9d0ab5d3dd4d0bbe7415cfa10cdiscoverystealer

Malware Config

Extracted

Family

vidar

Version

11.8

Botnet

0174ec9d0ab5d3dd4d0bbe7415cfa10c

C2

https://t.me/fu4chmo

https://steamcommunity.com/profiles/76561199802540894
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6

Targets

    • Target

      lyjdfjthawd.exe

    • Size

      275KB

    • MD5

      81a8c700d5bdd648c2848050da4edc4b

    • SHA1

      61e9ee541aac8aea077daedd1f31497b0bec2ab4

    • SHA256

      d7e8ecfbb9b6b70ac2314516226c94a32ccaba6c31aa4da4a52fa07c2cf22cd4

    • SHA512

      473b51e3bf9bb2c787db00b574d28306f209e9f6828b8e36b67b0fea81ec5fe303a4298accff51ee058ea7542049aa33950e9951fa33f248ab3799b826050087

    • SSDEEP

      6144:Ch0ZpFC4sffny7TuLBdZlT4DIJYdy3I8ioyrN:Ch0ZpFCfB3TGyYy3ziBZ

    Score
    10/10
    stealcvidar0174ec9d0ab5d3dd4d0bbe7415cfa10cdiscoverystealer

    • Detect Vidar Stealer

      stealer

    • Stealc

      Stealc is an infostealer written in C++.

      stealerstealc

    • Stealc family

      stealc

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks